Oracle Cloud：Juniper vSRXをFirewallにしたTransit Routing で Hub and Spoke構成してみてみた

#■目的
Oracle Cloud Infrastructure(OCI)のVCN Transit Routing はFastConnectまたはIPSec VPN経由でHub & Spokeによる複数VCN間の通信を可能にします。
そして、Hub内のインスタンスにFirewall、侵入検知システム(IDS)を設定することで、オンプレミスネットワークとSpoke VCN間のトラフィックをフィルタリング、検査することができます。
ということで、Firewallで有名なJuniper vSRXをGatewayとするHub and Spokeしてみてみます。

#■構成
<img width="769" alt="構成2.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/dcf832d4-6934-2251-41bb-06ebb994e2be.png">


#■手順
ここでは、Transit Routingに必要な図にあるRote Tableの設定をおこないます。
図面構成は次の記事を参考に構築します。
・[Juniper vSRX Virtual FirewallをOracle Cloudにインストールしてみてみた](https://qiita.com/shirok/items/c7a5dfb3cc3a228d7cb9)
・[Juniper vSRXでOracle CloudへIPsec VPN接続してみてみた](https://qiita.com/shirok/items/ba8bf1e514b9af74226b)
・[Oracle Cloud: VCNとVCNをLocal Peering してみた](https://qiita.com/shirok/items/79e85af83cee040aa62d)


このRoute Tableの設定でvSRX のPrivate IPをTarget Gateway に組み込むことでTransit Routingできます。
あと、Security List設定を忘れずに行っておいてください。


#■Route設定
以下経路になるように Route Table と Security Listを構成図のように設定

1) On-Premises Network から Spoke VCN Instance への経路

    ・onp-inst01:172.24.0.0/24 
        -> On-Premises IPSec VPN Router
        -> Internet GW : 0.0.0.0 
        -> vSRX: Ge-0/0/0.0 -> Ge-0/0/1.0
        -> LPG-H-1:10.100.0.0/16
        -> spoke100-Inst:10.100.0.2 

2) Spoke VCN から On-Premises Network Instance への経路

    ・spoke100-Inst:10.100.0.2 
        -> 172.24.0.0/16:LPG-Spke1
        -> LPG-Hub1 : 10.0.10.254
        -> vSRX:Ge-0/0/1.0 -> Ge-0/0/0.0
        -> Internet GW : 0.0.0.0
        -> On-Premises IPSec VPN Router
        -> onp-inst01:172.24.0.0/24 

##●Route Table 設定例
①Route Table: Hub-Frontend
<img width="940" alt="①Hub-RT-Public-Subnet02.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/b9e9ec64-9266-c546-eb8d-93f3a4c087f4.png">

②Route Table: Hub-Backend
<img width="937" alt="②Hub-RT-Private-Subnet01.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/9eed9143-808e-c61d-c744-aff0f582c7a2.png">

③Route Table: LPG-Hub1
<img width="939" alt="③Hub-RT-LPG-10.100.0.0_01.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/08493497-b181-2c90-321a-4de489ecf3e7.png">


④Route Table: LPG-Hub2
<img width="938" alt="④Hub-RT-LPG-10.200.0.0_01.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/56ae4065-ffc9-a1c1-f933-089df7ce99bf.png">

⑤Route Table: Spoke1 Subnet
<img width="937" alt="⑤RT-VCN-10.100.0.0_01.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/77f27d99-867d-e6f6-0143-8acab363d3d2.png">

⑥Route Table: Spoke2 Subnet
<img width="938" alt="⑥RT-VCN-10.200.0.0_01.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/27f12cb9-5119-bcad-8fa3-482cd5c0e21e.png">


#■疎通確認
##●onp-inst01 -> toronto-spoke100-inst

・ping確認

```shell-session
[user@onp-inst01 ~]$ ping 10.100.0.2 -c 3
    PING 10.100.0.2 (10.100.0.2) 56(84) bytes of data.
    64 bytes from 10.100.0.2: icmp_seq=1 ttl=62 time=63.9 ms
    64 bytes from 10.100.0.2: icmp_seq=2 ttl=62 time=63.7 ms
    64 bytes from 10.100.0.2: icmp_seq=3 ttl=62 time=63.7 ms

    --- 10.100.0.2 ping statistics ---
    3 packets transmitted, 3 received, 0% packet loss, time 2002ms
    rtt min/avg/max/mdev = 63.757/63.820/63.909/0.064 ms
```

・ssh確認

```shell-session
[user@onp-inst01 ~]$ ssh -i id_rsa opc@10.100.0.2 hostname
    toronto-spoke100-inst01
```



##●onp-inst01 -> toronto-spoke200-inst
・ping確認

```shell-session
[user@onp-inst01 ~]$ ping 10.200.0.2 -c 3
    PING 10.200.0.2 (10.200.0.2) 56(84) bytes of data.
    64 bytes from 10.200.0.2: icmp_seq=1 ttl=62 time=57.0 ms
    64 bytes from 10.200.0.2: icmp_seq=2 ttl=62 time=56.9 ms
    64 bytes from 10.200.0.2: icmp_seq=3 ttl=62 time=56.8 ms

    --- 10.200.0.2 ping statistics ---
    3 packets transmitted, 3 received, 0% packet loss, time 2001ms
    rtt min/avg/max/mdev = 56.879/56.937/57.022/0.061 ms
```

・ssh確認

```shell-session
[user@onp-inst01 ~]$ ssh -i id_rsa opc@10.200.0.2 hostname
    toronto-spoke200-inst01
```


##●toronto-spoke100-inst -> onp-inst01

・ping確認

```shell-session
[opc@toronto-spoke100-inst01 ~]$ ping 172.24.0.2 -c 3
PING 172.24.0.2 (172.24.0.2) 56(84) bytes of data.
64 bytes from 172.24.0.2: icmp_seq=1 ttl=62 time=56.8 ms
64 bytes from 172.24.0.2: icmp_seq=2 ttl=62 time=56.9 ms
64 bytes from 172.24.0.2: icmp_seq=3 ttl=62 time=56.8 ms

--- 172.24.0.2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 56.807/56.860/56.904/0.198 ms
``

・ssh確認

```shell-session
[opc@toronto-spoke100-inst01 ~]$ ssh -i id_rsa opc@172.24.1.2 hostname
    onp-inst01
```



##●toronto-spoke200-inst -> onp-inst01
・ping確認

```shell-session
[opc@toronto-spoke200-inst01 ~]$ ping 172.24.0.2 -c 3
    PING 172.24.0.2 (172.24.0.2) 56(84) bytes of data.
    64 bytes from 172.24.0.2: icmp_seq=1 ttl=62 time=56.8 ms
    64 bytes from 172.24.0.2: icmp_seq=2 ttl=62 time=56.8 ms
    64 bytes from 172.24.0.2: icmp_seq=3 ttl=62 time=56.9 ms

    --- 172.24.0.2 ping statistics ---
    3 packets transmitted, 3 received, 0% packet loss, time 2003ms
    rtt min/avg/max/mdev = 56.821/56.866/56.923/0.199 ms
```

・ssh確認

```shell-session
[opc@toronto-spoke200-inst01 ~]$ ssh -i id_rsa opc@172.24.1.2 hostname
    onp-inst01
```

#■参考
・[Advanced Scenario: Transit Routing](https://docs.cloud.oracle.com/iaas/Content/Network/Tasks/transitrouting.htm)